fix(02): resolve symlinks before fixture and vars path checks (WR-07)

Co-authored-by: Cursor <cursoragent@cursor.com>

tide/proxy_test.go

@@ -253,6 +253,23 @@ func TestProxyRejectsNonLoopbackOverflowAndCredentials(t *testing.T) {
 	}); err == nil || !strings.Contains(err.Error(), "outside") {
 		t.Fatalf("vars inside fixtures: %v", err)
 	}
+	if err := os.WriteFile(inside, []byte("{}\n"), 0o600); err != nil {
+		t.Fatal(err)
+	}
+	linkDir := t.TempDir()
+	link := filepath.Join(linkDir, "vars-link.yaml")
+	if err := os.Symlink(inside, link); err != nil {
+		t.Fatal(err)
+	}
+	if _, err := NewProxy(ProxyConfig{
+		Listen:   "127.0.0.1:0",
+		Upstream: upstream.URL,
+		Fixtures: fixtures,
+		VarsPath: link,
+		Rules:    mustParseRules(t, testRulesYAML()),
+	}); err == nil || !strings.Contains(err.Error(), "outside") {
+		t.Fatalf("symlink vars into fixtures: %v", err)
+	}
 	outside := filepath.Join(t.TempDir(), "vars.yaml")
 	p, err := NewProxy(ProxyConfig{
 		Listen:   "127.0.0.1:0",